NIST SP 800-53 rev5 · Access Control
AC-8 System Use Notification
Mitigates 1 ATT&CK techniques, used by 3 threats in this month's news.
Why it matters this month
Threats in SecurityTabs news using techniques this control mitigates.
Weaknesses it helps against
Through the techniques typically used to exploit them (CTID, CISA KEV).
- CWE-2841 techniquesImproper Access ControlRestrictions on who can access a resource are missing or wrong.
- CWE-2851 techniquesImproper AuthorizationThe system checks who you are but not whether you're allowed to do what you're asking.
- CWE-6391 techniquesAuthorization Bypass Through User-Controlled KeyChanging an id in a request (an IDOR) returns another user's data.
- CWE-8621 techniquesMissing AuthorizationNo permission check is made before the action, so any logged-in user can perform it.
- CWE-8631 techniquesIncorrect AuthorizationA permission check exists but is wrong, letting users act beyond their role.
Techniques it mitigates
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial. Mapping version rev5/attack-16.1.